OP
Product
Openmrs
19
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 3High 4Medium 9Low 0
Watch
Add Openmrs to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-43094 | 9.8 | May 10 | An SQL Injection vulnerability exists in OpenMRS Reference Application Standalone Edition <=2.11 and Platform Standalone Edition <=2.4.0 via GET requests on arbitrary parameters… Affected: through 2.4.0 |
| CVE-2018-19276 | 9.8 | Mar 17 | OpenMRS before 2.24.0 is affected by an Insecure Object Deserialization vulnerability that allows an unauthenticated user to execute arbitrary commands on the targeted system via… Affected: 1.12.0 before 1.12.1; 2.0.0 before 2.0.8; 2.1.0 before 2.1.4 |
| CVE-2017-12796 | 9.8 | Oct 23 | The Reporting Compatibility Add On before 2.0.4 for OpenMRS, as distributed in OpenMRS Reference Application before 2.6.1, does not authenticate users when deserializing XML input… Affected: before 2.6.1 |
| CVE-2026-40076 | 8.8 | May 6 | OpenMRS Core arbitrary file write and code execution via Zip Slip in module upload Affected: through 2.7.8; 2.8.0 through 2.8.5 |
| CVE-2025-25928 | 8.0 | Mar 11 | A Cross-Site Request Forgery (CSRF) in the component /admin/users/user.form of Openmrs 2.4.3 Build 0ff0ed allows attackers to execute arbitrary operations via a crafted request Affected: 2.4.3 |
| CVE-2026-40075 | 7.5 | May 5 | OpenMRS Core arbitrary file read via path traversal in ModuleResourcesServlet Affected: through 2.7.8; 2.8.0 through 2.8.5 |
| CVE-2022-23612 | 7.5 | Feb 22 | OpenMRS is a patient-based medical record system focusing on giving providers a free customizable electronic medical record system Affected: 1.6 before 2.1.5; 2.2.0 before 2.2.1; 2.3.0 before 2.3.5; 2.4.0 before 2.4.5; 2.5.0 before 2.5.3 |
| CVE-2025-25927 | 6.8 | Mar 11 | A Cross-Site Request Forgery (CSRF) in Openmrs 2.4.3 Build 0ff0ed allows attackers to execute arbitrary operations via a crafted GET request Affected: 2.4.3 |
| CVE-2020-5733 | 6.1 | Apr 17 | In OpenMRS 2.9 and prior, the export functionality of the Data Exchange Module does not properly redirect to a login page when an unauthenticated user attempts to access it Affected: through 2.9.0 |
| CVE-2020-5732 | 6.1 | Apr 17 | In OpenMRS 2.9 and prior, he import functionality of the Data Exchange Module does not properly redirect to a login page when an unauthenticated user attempts to access it Affected: through 2.9.0 |
| CVE-2020-5731 | 6.1 | Apr 17 | In OpenMRS 2.9 and prior, the app parameter for the ActiveVisit's page is vulnerable to cross-site scripting Affected: through 2.9.0 |
| CVE-2020-5730 | 6.1 | Apr 17 | In OpenMRS 2.9 and prior, the sessionLocation parameter for the login page is vulnerable to cross-site scripting Affected: through 2.9.0 |
| CVE-2020-5729 | 6.1 | Apr 17 | In OpenMRS 2.9 and prior, the UI Framework Error Page reflects arbitrary, user-supplied input back to the browser, which can result in XSS Affected: through 2.9.0 |
| CVE-2020-5728 | 6.1 | Apr 17 | OpenMRS 2.9 and prior copies "Referrer" header values into an html element named "redirectUrl" within many webpages (such as login.htm) Affected: through 2.9.0 |
| CVE-2025-25929 | 5.4 | Mar 11 | A reflected cross-site scripting (XSS) vulnerability in the component /legacyui/quickReportServlet of Openmrs 2.4.3 Build 0ff0ed allows attackers to execute arbitrary JavaScript… Affected: 2.4.3 |
| CVE-2025-25925 | 4.8 | Mar 11 | A stored cross-scripting (XSS) vulnerability in Openmrs v2.4.3 Build 0ff0ed allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the… Affected: 2.4.3 |
| CVE-2014-8073 | – | Oct 23 | Cross-site request forgery (CSRF) vulnerability in OpenMRS 2.1 Standalone Edition allows remote attackers to hijack the authentication of administrators for requests that add a… Affected: 2.1 |
| CVE-2014-8072 | – | Oct 23 | The administration module in OpenMRS 2.1 Standalone Edition allows remote authenticated users to obtain read access via a direct request to /admin Affected: 2.1 |
| CVE-2014-8071 | – | Oct 23 | Multiple cross-site scripting (XSS) vulnerabilities in OpenMRS 2.1 Standalone Edition allow remote attackers to inject arbitrary web script or HTML via the (1) givenName, (2)… Affected: 2.1 |
Showing 19